
Europaisches 
Patentamt 



European 
Patent Office 



PGT/EP200 4 / 0 0 9 2 21 



Office europten 
des brevets 




Bescheinigung Certificate 



Attestation 



Die angehefteten Unterla- 
gen stimmen mit der 
ursprQnglich eingereichten 
Fassung der auf dem nSch- 
sten Blatt bezeichneten 
europaischen Patentanmel- 
dung Qberein. 



The attached documents 
are exact copies of the 
European patent application 
described on the following 
page, as originally filed. 



Les documents fix^s k 
cette attestation sont 
conform es k la version 
Initialement depos6e de 
la demande de brevet 
europeen sp6cifi6e a la 
page suivante. 



Patentanmeldung Nr. Patent application No. Demande de brevet n" 

03090256.3 



PRIORITY 

DOCUMENT 

SUBMITTED OR TRANSMITTED IN 
COMPLIANCE WITH RULE 17.1(a) OR (b) 



Der Prasldent des Europaischen Patentamts; 
Im Auftrag 

For the President of the European Patent Office 
Le President de I'Office europeen des brevets 

P.O. 




R C van Dijk 



THIS PAGE BimK (uspto) 




Europaisehes 
Patentamt 



European 
Patent Office 



Office europ6en 
des brevets 



Anineldung Nr: 
Application no. : 
Deraande no: 



03090256.3 



Anmeldetag: 
Date of filing: 
Date de d^pdt: 



19.08.03 



Anmelder/Appl lcantCs)/Deinandeur(s): 

FRAUNHOFER-GESELLSCHAFT ZUR FURDERUNG DER 
ANGEWANDTEN FORSCHUNG E.V. 
Leonrodstrasse 68 
80636 Munchen 
AIiLEMAGNE 



Bezelchnung der Erf 1 ndung/TI tl e of the Inventlon/Tltre de V Invention: 
(Falls die Bezelchnung der Erflndung nicht angegeben 1st. slehe Beschrelbung. 
If no title Is shown please refer to the description. 
SI aucun titre n'est 1nd1qu6 se ref erer a la description.) 

A method for online detection and classification of anomalous objects 

In Anspruch genommene Prloriat(en) / PrIorltyCles) claimed /Priorities) 

revendlqufieCs) ^. ^ j jvc 

Staat/Tag/Aktenzelchen/State/Date/Flle no./Pays/Date/Num6ro de d6p6t: 



Internationale Patentklasslflkati on/International Patent Classification/ 
Classification Internationale des brevets: 

H04L12/26 

Am Anmeldetag benannte Vertragstaaten/Contracting states designated at date ( 
flllng/Etats contractants designees lors du dipdt: 

AT BE BG CH CY GZ DE DK EE ES FX FR GB GR HU IE IT LU MC NL 
FT RO SE SI SK TR LI 



030902B6.3 
EPA/EPO/OEB Form 1014.2 - 01.2000 



7001014 



2 



THIS PAGE P! W( (uspto) 



Aug,19'2003 09:i0--^49 30 ,8825823 Maikcwsii Ninnemann iJ7623 P. 007 

+49 30 8825823 

e^o^ 

^^^-Q^ System and method for online detection 



and classification of anomalous objects 

1 Reld of the invention 

ooQtiAuoua date strcama, osd, in pwticiilar, to detection and dos^cation of anomalous 
padcets ia computer networlcd, of imomalous records in compxiter logs, of anomalous 
meaauremcnta of other activities such aa operation of mecbaatcal devlcea^ themical, bi- 
ological and medical pro ce s s es. 



2 Summary of the invention 

A system and nethod aie disclosed tper online detection and dassificaiion of anomatoos 
objects in contf naous data atxcams. Tbe extern oonsists of the online anomaly detection 
engine and of the optional featiue extratlon and clas^ficatjon components. 

The online anomaly detection engine consists of a processing unit having memory for 
storing the incoming data, the limited "worUng set, and the geometric re p res e ataxion of 
the normal (non-^omalous) data objects by means of a parametric hypersurface; stored 
programs including the programs for procesdng of incoming data; and a pzoeesaor con- 
trolled by tbe stored programs. The proeesoor indudes the components for constraeticn 
and update of the ssometric representation of normal data objects, and for tbe dttcctim 
of anomalous objects based on the stored representation of aonnal dat^ objects. 

The component for construction and update of the geometric represoktation zoodveo a 
data entry and imports it into the representation such that the smallest volume endosed 
by the hypersurface and consistent with t:ha ps^-defined eocpeeted frac^on of anomalous 
objects is mafntained; the component further identifies tiie least relevant entry In tihe 
urorking set and removes it "wtdle maintaining tbe smallest volume egadosed by tiie hy- 
persurface. Detection of the anomalous objects is performed by Aeddng if the objects 
fall udthin or outside of the hypersurface repre»nting the normattty. 

As an embodiment of the invention, the ardutecture of the sjfstem for detection and 
classification of computer intrnsSona is Asdosed. The syatem consists of the feature 
extraction component xecdMng data from ti&e audit stream; of the online anomalty de- 
teecioiL engine; and of the classification component, produced by the event 
engine trained on the database of appropriate eveots. 

The invention is also applicable to monttoiittg of the measurements of phy^cal panun- 
etm of operating mechanical devices, of the measurements of diemical processes and of 
the measurement of biological activity; 
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3 Brief description of the dramiings 

Fig. 2 is tlie flGiv-^iart of the algorithm utilteed for the eofidtrootion eAd the update of 
the gecmetrie raparQ^entation of normal objects. 

fig. 3 is the achematie diagrem of the system for detection and olassiflcaiJon of compoter 
iatru^ona based ou the disclosed <ml!ne anomaly detectioti en|^e< 

4 Claims 

1. A method for online detection of anomalous ohjeeta in a oointinuous d8i;a stream 
based on the foUo^itog principles: 

a) geometric xepiesentation of the class of the normal objecta^ 

b) dynamic adaptation of the said representation ixpon the arrival on the new 
dauk 

2. Ihe method as defined in claim 1> wherein the objects are data padcets in comr 
mtndcation netwoxlcs or representations thereof. 

3. The method as defined in claim 1, wher^ the objects aie the records obtained 
firom logging the processes on the computer system or lepresentationa thereof. 

4. The mietliod as defined in claim 1, wher^ the objects are measurementaof physical 
charaeteriailcs of operating meehanieal devices. 

S* The method as defined tn claim 1, wherein the object» are measttremeots of Mo- 
logical Bctivity. 

6. The method as defined in claims 1-6. wherein the class of the normal objects is 
r^resented \ry a parametric bomidary hypersurfaoe in a pre-defined feature spaoe^ 
such that said snxfece ^closes the smallest volume among all possible smdEaoes 
cor»stent with the pre-defined firaction of the anomalous objects. 

7. The method as defined in daim wherein the feature space is induced by a 
suitably-defined similarity function between the data objects satisfying the eondi* 
IdottS under which ^e said function acts as an inner product in the said feature 
space. 

8. ThA method as defined in claim 7^ whm^ein the anomalous objects are determined 
as the ones lying on the other side of the boundary hyperaurface representi ng the 
class of the normal objects. 
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9. The metlicd as defined i& dalm 8, wher^ the xvpxesentatioxi of die dass of the 
nomal objects is vipdeted upon the awival a new data objec t, nonnal oraaoma^ 

toi&z 

10. The method as defined m claim 9, wherein the update of the xepresentatton ef 
the daes of the normal objects comprised the adjustment of parameters of said 
representation so as to incorporate the new object while malntainiAgthaoptanalSiy 
of the representaticm. 

11. The method as defined in claim 9, wherein the update of the representation of 
the class of the noxmal objects comprises the adjuatment of paxameteis of said 
representation so aa to remorve the teast-relevant object while maintaining the 
optimally of the representatim. 

12. The method to initialize the method defined in elaim 9, so thas the smallsUvvdume 
tepresentatfon is maintained starting from the moment when the smallest possible 
amount of data is available for which such representation is possibte given the 
predefined fraction of anomalous data. 

IS. K metitiod for detection of anomaloos objects tn a collected database whmby Ifhe 
method as defined in claim 9 is ^plied to the database one entxy at a time. 

14. The method aa defined in daim 13, wherein the objects in the database are rotegtoi 
data padcets in coounuaication networlcs or xepresentatloaa thereof. 

15. The method as defined in daim 13, wherein the objects in the datsibase are the 
cbUacted records obtained from logging the proceBoea on the oomputer sgrstem or 
representations thereof. 

16. Themethod as defined in daim 13, wherein the objects in the database are colfecfeed 
uieasuremeots phsrsical diaracteriatics of operating mechanicel devloea» 

17. The method as defined in daim 13, wherein the objects In the database are cdlect^ 
measurements of biological activity. 

18. A method for classification of anomalous objects wherd^ the methods as defined 
in daims 9 or 13 are used as a pre-processing step. 

19. A method for dassificaiion of anomalous objects whmby the information col- 
lected fay the detection metboito as defined in dalns 9 or 13 is combined with the 
iaformation used by other das^cation methods. 
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5 Detailed description of the invention 

„ . . ... •-•Slie^lnveDtioircoikStitttti^'ttfir^^ anTdiossification 
of anomalous o'bjects. The main component c£ tlie ioveatUm is the onluie aaomaly 
detection e&gSne. 

The overall ^eme of the mid system is depicted In Fig. 1. The input of the system is a 
data stream 01 pertainins to a partieulaj application. The data stream can be padcets 
in oomxminication aetworks. entries in the various activity logs in computer systems, 
measuxements of physical characteristics of operating mechanical devices^ measurement 
of parameters of chemical processes, medsuremsnts of biological activity^ and otheis. 
The crucial feasure of the inveation is that can deal with cone^v^tt^ data streams in 
an online fashion. If idr some reason online data procdstfng is not desired, or U some 
I . intermediate storage of the data in a database or in a storage buffer is required, the 

^ invention can litewiee be applied to the stored ciata, as indicated by D2« Vy sequential^ 

processing stored entries. Each of the incoming data entries is supplied to the featwe 
extraction unit Al, which performs the pze-process!ng required to obtain the features 
D3 relevant for a particular application. Altemativetyt if the data entries axe su^ that 
they can be directly used in a detectlon/classificastion method, the feature ^tra^oo 
step can be eldpped. 

The main step A2 of the online anomaly detection en^e consists of the eonstniction 
end of the update of the geometric repreBentation of the notion of normafitjr. The 

' geometric repiesentation of notmaliiy D4 is a parametric hypcrsurfaoe enclosing the 

smallest volume among all possible surfiaces consistent with the pre-defined fr^ion of 
the anomalous objects. The said hypersurfieice is constructed in the feature spaoe induced 
hy a suitafaly-deSned simSldiity function between the data objects (*%emel fiinction'*) 
satisiying the conditions under which the said functinn acts aa an inner product in the 
sadd feature ^ace (<^reer conditions'*). The update of the said representation ineotves 
the adjustment so as to incorporate the latest data entry* and the fi4]Ufitment so as to 
remove the least relevant data entry so aa to retain the ^eapsuhi.tion of the smallest 

» volume. Once the normality representation is updated, tha anomsly detectioa A3 is 

performed assigning to the data entry the status of a normal entry, if the entry 
falls into the volume encompassed by the normally representation, or the status of an 
anomalous entry» if the entry lies outside of the volume encompassed ^ the normality 
representa^cn* 

The output of the online anomaly detection engine is used to issue the anomaly warn- 
ing 05 and/or to trigger the classification component A4 which can utilize any known 
classification method sach as decision trees, nsuf si networks, supi>ort vector machines, 
Fischer discriminant etc. The geometric representation of nsrznafity can also be supplied 
to the dassification component if this is required by the method. 

In the exmplary embodiment of the steep A2 the faypersurfiuce representing the class 
oif normal events is represented hy the set of parameters si, « . . »«n> one for eadi entry 
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in the "oiorldng set. The size n of the worldiis eet ie chos^ in advance by the vtset. 
The parameters ere farther r^ricted to be tton^n e gativei and to h ave valucsjl^^an 
or equal tonO"« "17(^5)7 wECTeTi^ expected fractica of the anomalous events In 
the data strcan^ to be set fay the user. The >vorIcing set it partitioned into the ^set 
of the entries whose parameters x;^ are equal to ^eroi "set of the entriea whose 
parametexe axe equal to C, and the ^set S" of the remaining entries. The operation 
of step A2 is illustrated in Fig. 2. Upon the arrival of the data entry the foBondDg 
thxee main actions are perfbtmedi in atep AZ5 the data entry is "imported" into the 
vorktng set, in ^bsp A2.6 the least relevBAt data entry I fa apu^t in the ^smrUng set, 
and in step A2.7 the data entry { is remotved from the working set. The importation 
aad removal cperationd maintain the minimal volume enclosed by the hypetsurfiace and 
OQOsistent to the pre-defined expected fraction of anomaloua objects. These operations 
are esq^lained in more detail below. The rtdevance of the data entry can be judged either 
by the time stamp on the entry or by the value of parameter Xi assigaed to the entry. 
The steps A2L1-AZ4 are the initialization operations to be performed when not esiou^ 
data entries have bocn observed in order to bring the ^tem into equifibritint. 

Construction of the ho^ersnrf ace D4 ^closing the smallest volume and consistrat with 
the pre-defined expected firactioa of anomalous objects amounts* as shown in the exttde 
"Support Vector Data Description'' by D^AIJ* Ttoc and R,P.W- DuSn, Panem Reeog^ 
nttion Letters, voL 20, pages (1999), to solving the following mathematical 

progranciming problem: 

max ^min^ : -c?*flp + |»^ifa5 + Ma^«-f-6), (1) 

Where JRT is a n x n matrix that consists of evaluations of the given kernel fonctiion for ^ 
all data points in the working set: Ki^ — le8meIC2^,p^)« c is the vector of the numbers 
at ihB main diagpnal of a is the vector of n ones» snd b = —1. The parameter 
O is related to the expected fraction of the anomalous objects* The necessary and 
sufficient condition for the optimaliQr of the representation attained fay the solution 
to problem (1) is given by the weU-loiown Kerush-Kuhn-TUdcer conditions. When all 
the points in the working set satis^ the said conditions, the worldng set is said to 
be in equilibrium. Importation of a new data entry iuto. or removtd of an existing 
data entry from a woxkSng set may result in the violation of the said conditions. In 
such case» adjustments of the psxameters zi, . . . ,iffn ere necessary, in order to bring the 
workSi^ set back into the ec|uilibriuin. An algorithm for performing audi adjustments, 
based on the Xarush«Kuhn»7Ueker conditions^ for a diffeceot mathematical programming 
problem — Support Vector Learning — v^ isresented in the article ''Incremental and 
Decremental Support Vector Learaix^ by G. Cauwenberghs and T. Pog^o, Advances 
in Newrol rnfctmtaicn Prvceasing Sj/stem$ iS, pages 409-415, (2001). By deriving the 
Karush-Xuhn-THidcer condittons for the problem (l), the necessary ingredients for the 
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application <tf tlie method of Cauwenberghs and Poggio caa be obtained. 

Special core needs to be taken at the biitiai ph^eof Jhgjgpgg don of the online 
-aBomaly-^ctection-«rpx«- »^ rounber of data entries in 

isbewrkingect is less than or equal to L^J (the greatest integer smaller than or equal to 
equOibrium cannot be readied end the method of Oauweaberghe and Poggio oaanot 
be applied. The inltlalisaaoD steps MAr-AJtA are deigned to handle tbia spedal case 
and to bring the working set into the equiUbTium after the amaUest possible nmnber of 
data entries haa been seen. 

Hie exemplary embodiment of the online anomaly detection method in the syswm 
for detection and dassification of computar intrusions is depicted in Fig. 3. The input 
of the said system is aa audit atieam wliidQi eoataSna network pacScots and records in 
Che audit logs of ooanputeis» The audit stzeam is input into the feature oetraetfoa 
cofflpommt comprising a set of filters to extract the relevant features. The extracted 
features are read by the online anomaly detection engine whidi identifies anomalous 
objects (padcets or log entries) and issues SA event warning If the event is discovered 
to be anomalous. Classification of the detected anomalous events is performed by the 
classification component previous^ trained to daasily the anomalous events coUected 
and stored in the event database. 
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APPENDIX 



ONLINE SVM LEARNING: FROM 
CLASSIFICATION TO DATA DESCRIPTION 

AND BACK 



Atote^ Tfae paper present* tvro nseful oxtenetona of the iae«- 
mratal SVM la the etwiffirt ef mUBe leandaff. An online sapiM 
v«8t^ data deacrlptten «Isorithzn enabbis appGeation of the onliM 
paradigm to uBsupae^ed leaming. IWthermose, online leanSne 
can b» used In the lavgMeale claseifieatioa problena to linSe^te 
memory regtaxameots fbr storage of the hsniel matrix. Tim pk»- 
posed algnrtthniB are evaluated oa ttie eosik «f online noaftortos 
iteta, and <« fihe clas^eatfoa iaolc of leanains V^pS 
datasa* with afptSeri dnsea worldng set siae. 



XNTRODUCXIOiN 

Many la^Ufe madiSne leamiag ptoblems can be mote oMoralhr viewed as 
ealteavaattihaabatdi)Mn^ todeed, the data iaofteoeoUeeted 

eMtant«ui|]rm«me,aiul. XBore impartantty. the concepts to be leaned may 
also cvolvB to time. Sigailleajit eiBbrthMbeea spent i» the recent on 
ifcrv^qpaient of oolioe SVM leaniae algodthnu (e.e. [17, 13. 7. Mil. The 
elegant solution to eaKae SVM leamins ia the imratai SVM M WuSb 
pwwid w a framework CBTeacaaoDUneteaniiBg. Ibthewaliaof this work t»o 
ectn^s to the ngresgioD SVM have beeo indepautently proposed [liK 91- 
One Aoiald note, boweser. a aignificant testiictiaD on the appUca^ty of 
tac nove-mentiened tvpenriaei online leBRuog aleortthina: the labels 
not be available oaKne. as it would require maaual interveatiea at «ve4 
^pdatestep. A more reallstfc scenario is the update of the eadstlageUwifkr 
whenanewhatth ofdatabeeoawtawnaWe; The true potential of oafiae 
leaiBiBscaaontrbexealteed In the context of Bftnpervi»ed leaning. 

relevant unsnpeivised leamfaig prebleai b one^lase 
oaesIfi^tanfia.lO. ^sproblemaoioimeetotnuatnuftinsannltiH&aende^ 
dMa desoiptkm, and tt0 main ^ppli«stion ia aoveltr (outlier) detection, bi 
«M8 caae online algoriduna aie eaaeatial. for the Mme teaaaas that xaade o». 
fine learatag^amacttva ia the aupecviired eases the dynamic aatore of data 
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and driStiag coacepta. An online support vector data description (SVDD) 
alggirltbm based on the Inaremental SVM is proposed in this paper. 

LooIdQsbadcat tiie supCTV ised leanuogi a d ifferent tele i^_beseg5n,feyjro^ . 
jioe-algOKittam. OMfiairleanang can bo ttscd to uvta to m e memoty Undtations 
typical for kcmol neUiods on largo-ecale probleme^ It baa been long laonm 
that atc»raee of the luH kemd matriXf or even the part of It coxxespondias 
to support wetors, can well oxceed the available mMiory. lb overcome tfda 
problem, several aubdampliog techniques have been proposed (16, 1]. Online 
Iwff^ng can provide a eimple solution to the subsampl^g problem: make a 
Bweop tteon^ the data witb alimited ttrortdn£ set, each time adding aaew 
example and removing che least z^tevant one. Although this prooedure re* 
suits in an approximate solution, an experimeni on the USPS data presented 
in this paper shows that agi^cant reduction ot memory reqinxemeata can 
. be achieved without major deoteaso in das^ca^ion accura^. 

lb prcBtat tho above-mentioned extensionQ we fitet need an abstract for^ 
mulatloa of the SVM optimiaotion problem and a brief overvlev of the In* 
elemental SVM. Then tito detaito of our algorithaa an pteaen^d^ foBowed 
by their evaluation on real-lifo probtema. 



PROBXiSM DEFINIXION 

A smooth extension of the incremental S V M to the SVDD can be cazried out 
by using tke foHowing abstract form of the SVM optinnzatlon problems 

snas^ mJn^ : 17 = -o?r* + ia:^jr»^/4(o^a? + 6), (i) 

whex« c and a ace n x x vectors, iCls a n x n matrix and ft is a scalar. By 
deStdngtbe meaning of the at^etract parameters a» band c for the particular 
SVM pr^em at haad» one can »se the same algorithmSe structure for differ- 
ot SVMdtgorlthmd. In parttcular, for the standard support vector dassiSers 
a^l, take e s I,o » Vt ^ - ^ ^ Siven regularization constant C; the 
same definition appUes to the v-SVC [IS] except thafc C » Ibr the SVDD 
{14, 18)> the parameters are defined as: o » djag(Jf),a ^ y and h — -1. 

Incremental (detremental) SVM provides a procedure for adding (temov* 
ingl one mftmplft to (&om) an esdsting optimal solution. liVbon a ne«r point 
k is added, its wel^ to initiaUy aasignod to 0. Then the velg^ of other 
potnta and |« ehouhl be updated, in order to obtain the optimal aOltttion for 
the enlarged dataset* Likewise, when a point is to be removed from the 
dat&aet, ita wei^t la forced to 0, while updating the wra^^ ^ remaining 
points and M BO that the solution obtained with Xfc » 0 is optimal for the 
reduced dataset. The anline learning foUowa naturally firom the ineremeiv 
tal/decremmtalleaamiog; the new example is added while some old example 
ie removed firom ^ working set. 
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INCREMENTAL SVM: AN OVERVIEW 
Main Idea 



The ba^e prindpl? of ilie incremeBtal SVM [4) ia that Uf dates to Ae state of 
Vus exampk k ^eu!d keqt the rtmakUng extmptat in cAefr optlmat state. Jn 
ower wmros, tiie Kvhn-l^icker (KT) contStiona: 



if 2{sO 

if 0<xi<C 
if a(«C 



<2) 



{>0, I 
= 0, a 

nmst be maint^ned fior all the acamplea, except possibly for the current one. 

-Bb maintain ofiOmaHty in inaekte. one can write oat con^tioiis (2)-(3) 
foe the states befioxe and after tliev|idate(tf«t. ^aubbacEfnsane&oiaUie 
aOua the feUowing eondttioa on iaasmenta of iA» and la obtained: 




(4) 



^« s nb8crt»t a teSst to the ocanplet ia the set S cf luboanded sui^ofc 
TWfeoee» and the sabsoipt «• refine to the aet ij of bounded snpoort vectois 

(£) and other examples (O). It licdlonDs from (2) vha»A7« " ~ 
and 4 of the ssrstem (4) can be re-«ritten ae: 



■ O. 



This Gaear system is easQjr sehed for Ae: 

Zl« s ^Ase> 

vbe»e 



(a) 



(6> 



ie the ^adieet of ijie linear maoifbld of erpitimal sMutieea psratteterised 

One can fiirther substitute (6) Into the lines t and 3 of Oe systeni f4) 
and dbnam the foUonins xelation: 
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when 



^ xt:]i*[M 

--irt£e'pia{ed~Wt£e'&iear manifold of tbe gradiesfcB of the examples in set 
R A the optinaA solution ixarametaxlzed by ^k. 

Accowiiiiss i^stematie aecoimt 

Notice that ai) the i^asoaing tn the precedisg 5«teoo is vaKd only fcr suS- 
oentty small Ax^ auch that the cpn^Ofl&tloii of aets jr and R doea not change. 
Although coxaputtag the optimal Amt hi not pocsihle in one «tepp one caa 
compute the largest update %wk that eompflsltion of sets S and II 

vemaiaa faitact. Fbur eaaea muat m acoomited fiar^: 



1. Some Xi in S readiaa a bou&d (upper or iow^ one). Let e be a small 
number. Oompute the sete^ 

« <i € 5 : dso( A«Jb)^ > c> 

The oampltt In set have poaitive seamtivity ^th respect to the 
cweat example; chat ia, thtir wogbt would Increase by taJsing natep 
These eicamplea should be tested fbr teaching the upper boond 
C Utewise, the examples in set Z£ should be tested ibr reaching 0. 
The namples with -e < A < e can be ignored, aa they arc insensitive 
to Axt^ Thus the poaaible wdght updatea eies 



aad tlt« lai^est posribie Axg bcTote eaa oC the demeota in 5 readies a 
A*f-abBnia5SL., (10) 

where 

ahspin («) min |xi| - ^gtt(«(ai^ia|««l)}- 
2, Some 9; in Areachea eero. Oompute the seta 

If = {< € O : at|pi(A«ithfe < --Mi- 
llie examptea in set have poaMve aeosifivity of the grddieat with 
expect CO the wetgjbl; of the current example. Tliere&re fihcir (negative) 



the eneSnai vork of Ca)a*»eftbergliB And Poggla&ve cases ar^ u«>d but two of them 
^Nete that ^8n(^») i» -Hi f<tt- tUo incranontal and -I to tha dcercmemal < 
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grattaitscsm potentially readiO. Likewise, gradlcsnts of the focamples in 
«epw Wvc but are piished towards 0 with the changiag weirikt 
of ifae current Qxampte. Qnfypoiiits inJ^^uZf need to be con3idei«d 
«4bt^npuiatioanoftlre^]aii«^'^l^^ 

3- becomes 0. Tbia ease is ^inilflr to case 9, OMoept that &ausibiEty test 
becomes: 

md if It bolcto» tihe largest update Aa^ to computed as: 

4. Sft Madies the bound. TTh* largest possible ioeroneat ia dearly 
Aarl-/*^'-*** tf.»lsadd8d 

FfBttKy, tiie kaqgest pos^e update is oemputed axnaae tbs four cams: 

A«g*" *» *>»««Ja (lAasf ; Aaf : /Sa*: A«J]). (14) 



merest or «e meremental SVMalgoritbm essratiaUy consfsts of z^peaced 
computation ttf the update Aaf update of the sets S, B and update of 
thestate and oTtbe saiuitiviiar parameters /9 and r Tlie itetation stops when 
QOtf ease 3 oe caae 4 oeevcs fa the tnerameot eonApatattao. Computational 
aspects of the alsorichm can be fbund in (dl. 



vw « VI coac V oBcwn in ne ncnmei 
aspects of the alsorichm can be Ibvad ia 

9pedal cases empty aet S 



Appling this incxemental algorithm leaves opea the possIblKty of an empty 
set 5. 1^ baa ewo main eoDBequaaces. FIcst, all the hlodcs with the sob- 
so^ a vanidi from the KT ooodHlons (4), Secwd. it is be impossible to 
mcteBsethe neiElit of the cuneat exampte since this would violate the equal- 
ity eoasteaint of the SVM. As a result, the Kt eonditioaa (41 eaa he written 
compenest-viee aa 

One can see that the only free variable b Am, and [o*;!*,] pbya the icte of 
^eantivityofthegjradieat with respect to Af*. lb select the points &oa£ or 
O which m^ eoier set 5. a fba^ldlity rdatlonshi^ dmilac to the «as^ 
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can be desHed. Rfssolvlag (15) for Am a&d substituting the ccsolt Sciio <16), 
ve conclude that 

Tkau, using thB KT ean^tioiia (2), the iisaalbte index sets can be defined «s 
2V«0e5:.2igk>«) (IT) 

life 

aad the largest possible gtep Aju""" caa be computed as: 



ONUNBSVDD 

As it was mentioned in the intxoductien, the onfine SVDfi nlgoritbm 
the same procedim as the inaremental SVM, with the following defint^ne 
of the abstract pamniefiera in probtem <1): c = dSei8{iC)>a = » and -'I. 
HoveveTi epedal ca» needs to be taken of tte initiaUsatiOa stage, in cvder 
to oht^n the initial feasible solution. 

loStialisation 

Tot the standard fliippost veetor dasdScatlon, an optimal sohition for a. ein- 
gle point is possible; zx ^ 0»6 - vi- ^ ^ incremental SV1>D the sitoatloa 
is more eompliCAted. The difficulty arbes from the foct that the ecpiaKty 
consuniBt OiXi 1 and the box conBtraint 0^X4^0 may be incM« 
»stent; in particuleri the conetrnint cannot be aatlAfied when fiswer fban f^l 
examples are avs^able. lUs Imtial solocion can be obtaiaed by the following 
proceduKQ] 

1. l^t&efini l^J objects, afisigo them wrisbtC and put tbemia£. 

3. Compute the gtadiente 9,- of aO objecte, using (Q. Conpvte m such 
thai §ar aU objects £ the gcadieiit is less than or e^tidl to asm: 

(20) 



4. Enter the raein loop of the ineMmontal elgorithm. 
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Cl^alflwtloft ef a tbu eerlos oaing a teetf daasifier (top) u Mfioe 
i^snte (boftcaa). The dotted line vitk the resnUr peaka ax« the Wa^te. 
The aeior solid Uneladsemtlieclaeei^ The dwhcd One is ito GOG 

iBdicatii^ the eciivl^ of 6he Cn pmicdw eye-hfinke). 

Sicperiments on Bd data 

ThlB «perbnent9 shows the uveof the oaiUne navoltj detection teak m ma* 
stathmary time aeries data. The osliiie SVDD ia applied to e Bd (Bkain- 
Ctomputerabtorihce)pr0jaet(2,d). A eubjeet waaaittingin ftmt of aeom- 
puter, and was ashad to prees a key o& the keyboard udng the left or the 
xishe Ihurios *k« experiment, the BEG hrain ^paals of the eubjeet axe 

recorded. PVom these algxiala, it is the task to predict «4:kld) 
£of the h9y pree^. The first step in tha dasaificaXion task reqintea a^distinc- 
^on between *mooement' and ^o-movement' whicih fibonU be nkade n&Bne. 
The inaemeata] SVDD wiU be nsed to characterise the normal activity of 

Oe br^ audi that sp^Ial events, Bke upcoxning keystroke movements^ 
detected. 

Alter preproceasing the EEQ signals, at each time poim the brain aetivi^' 
dinmexcri^id by 21 feature valtios. Tlie dam;^bt^ rate «aa ledneed to 10 
Ha. A x^dov of SOO time points (thua 5 seconds Umg) at the start of the 

^f^t^'SS^™*^**^''*^^*^^ to the top plot offigurel the output 
«tWaSVnD Is shown through time. Ibr visualisation purposes Just a very 
short, but characteAtic part of the lime series iaahow^ The dotted fina 
^th the regular single peaks indicated the timea at which a key was pressed. 
Themstput of Che dassafier ia shown by the solid n<usy Kne. When this line 
aero, an outlier, or deviation from the nonnal sitnation is detected. 
Tte dashed fine at the bottom of the graph, ahowa the muscular aetivHy at 
the ws. The large spikes indicate eyo blinks, wWch ave also detecced as 
outhers. ft oppeaiB that the output of the static dassiaer through time is 
very noisy* Although it detects some of the movements and eye blinks, it also 
generates many {also alarms. 

In the bottom plot of figure I the output of the online SVDD daesifier ia 
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VECTOR OMSSmCH (RBF fCeHMBI., ^'«0^-2e6> WITH justM OBJCCTS. 

Jtf t 50 100 ISO .28S^.jaO — 300.-^ -op— 
— «Otii?^>hUl 6^ 4,rt 4,48 4,48 4,38 
sbown. Hare againi an output above 200 indicates that aa outlier is detected. 
It IS dear that the ooliae'^versian generates less folse alaxma, because It foOowB 
the chaogUDg data distribution* Altho^xgh the detection » to ilrom perifect» 
as caa be obaerved, maay of the toyetrckefi are isdoed dearly detected ae 
outttexa. It 18 also dear that ite method is easily tKiggefed by 
UofixriiaAately the dsnal le very nolqf, and it U hard to quantify the eacart 
periomuunoe for these methoda oa thia data. 

OX«£XNE LfiABIONCr IN LAROE 1M3ASBT9 

1k> mate the SVM learcdag appOeahle to very large datasete, the elaedfier 
has to be constrained to ham a^ted number of objecfca in menuMy. This 
is, in pxindide, exactly what aoa onllQe dasdifier with fixed wfaidoar ^ M 
does. IChe only difietcnco to ttot removins the oldest object is not usefiil in 
this ap|>lScatlo& because the sam result Is achieved as If the leamfaii; bad 
been done on the last Af objeeta. Instead, the *lMst relevant'' object needs 
to be removed during eaeh windov advancement. A reasonable cri^tim for 
relevance seems to he the veAue of the wdght. In the experimgatt ^^^^a ented 
bekrn the example with the raoallesi weight is removed from tho vrviUnsset. 

IBxpetkausaalt^ on the USPS data 

The dataset Is die standard US Postal Service datoset, containing 7291 u^n- 
ing ond 2007 ImAgce of handwritten digits, ehso 16 Hie [ifi]. OathselOdass 
dataset 10 support vector classiSets with a BBP kemd, ^ 0.3- t56aad 
lOO^wese trained'. Duxingtheevahiaaonofanevobject.itieasdtoaed 
to the dass comsponding to the dassifier with the largest output. The total 
cbssificadon error on the test set for difltercut window altea M Is shown in 
table 1. 

One on see that the das^cation accuracy deteriorate? mar^nslly (by 
about 109S) until the worUng mee of 180, wlndk about 2% ci the data. 
Ctearly, by discarding "Irrelevant'* example3> one removes potential support 
vectors that cannot be recovered at a later stage- Therefore it ia e9q>ected 
that perfbrmanoe of the limited memory classifier would be worse than that 
of an unMStdc^ classifier. It is also obvious that no more points than the 
number of support vectors are eventually needed^ although the latter number 
is not known in advance. The average number of support vectors per each 
unrestricted 2-dass daadfier in this experimsnt is ^74. Therefore the te sulte 
above can be inteiprcted as reducing the storage requirement by 4fi% fiom 

^The best modd ^aiAStem as repoitsU la [ts) wm used. 



I 



V 
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the minimal at the cost of 10% ineteadc efdimiiicatioB pxoblea^ 

Noticediat Aeprop08edaerat<?gy<Oflao^^ 
for mmy SVM^'^^^.likc aisoritbns ft 8, SJ. in vhlcb kem d products mte^ 

coinjmted-if-tlie-cxamplesrarertc^^ cache and the ~" 

accwacy of tho dasher is noe sacrificed. Qur approach eenstituts a trade- 
off between aceoiao^ aad compEutatimal bad beouM temel prodocta never 
need to be re-computed, ft should be aoted, bowcrver, that computatiooal 
cost ^ze-eomputing the kernels caa be vevy significant^ eopecianr fbr tte 
ptoblema with complicated kernels such aa atiins match&ng or amvotvtlon 
Jcemels. 



CONCLUSIONS 

^ Based on revised vereioa of tho iaoremental SVMt ^ have proposed: (a) an 

raline SVDD algorithm which, unBte aO previous extensions of Iscnmentat 
SVM. deals udth an nnsupervteed leaniliig problem, and (b) a fixed-memoiy 
t^i^ algoriti^ fior the clasaffieation SVM which allova to limit the menv- 
ory requirement tot storage of the Itemel matrix at the o^ease of dasrifica^ 
tion pex£>imdaee. Experiments on nov^ty detection in non^tationaiy 
series and on the USPS dataset demonserate fisasibittty of both ^proadies. 
More detailed comparisons with otter fiubsampline techniqaes fbr limited^ 
memoiF leandng will be canted ont in fiiture mek. 
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Fig. 1: SC^MATXC DIAGRAM OF THE SYSTEM. 
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put enlnr ik into set 5 
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Fig- 2: Construction and xjpvatb of the geometric reprb- 

SBNTATION.! 
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